[objectstack-fleet]

Requested by Sales · project thread

Fixes #25082

The notification half of ruling 6335348115 (items 2 to 4). The email half is #25189, which is not addressed here.

Clause-②: no (narrowing)
Metadata-protocol: none

What changes

renderNotification HTML-escapes every hole's value in an html or mjml body (the five characters an HTML parser reads as markup in element text and in a quoted attribute value). That encoding is right in exactly two placements: element text, and a quoted plain-text attribute value. A sys_notification_template save whose html or mjml body places a hole anywhere else is now refused.

• The judge (template-hole-placement.ts) is this package's own, beside the renderer's hole grammar (ruling item 2). It reads the holes through the renderer's own token (templateHoles, new in template-renderer.ts), so it judges exactly the spans the renderer substitutes. Its placement table is re-derived from the renderer's encoder, not copied from the email half. It uses the same class names and author-facing labels as the email half, plus one class of its own, meta-attribute (every attribute of a meta element, read as a setting of the document).
• Context-strict (ruling F3, C2): a hole is supported only when every reading an HTML parser can give the body places it in one of the two placements. The scan forks where the tree builder decides what the tokenizer cannot: at a noscript start tag, and at every raw-text or escapable-text start tag once a select or frameset is open. Foreign content (SVG, MathML) is never treated as left, so every hole after its root is refused. Each of these rules only refuses more than a parser would.
• The save hooks (notification-template-placement.ts) are beforeInsert / beforeUpdate on sys_notification_template at priority 30, bound by MessagingServicePlugin.init on the kernel's ObjectQL engine and unbound in destroy(). They are hooks rather than a validation rule because a CEL condition has no reading of HTML placement; plugin-security's grant-name refusal is the precedent shape.
• Judged over the merged record (ruling item 4): an update is judged on the stored row overlaid with the write, on the by-id path and per matched row of a predicate update. A row stored before this change that breaks the rule is frozen, not bricked: it is refused on any edit that leaves it breaking the rule, and it is still read, listed, deleted, rendered and delivered. Nothing runs at send and no stored row is rewritten. There is no migration.
• The envelope: the existing 400 VALIDATION_FAILED with one finding at body, code: 'invalid_value', naming each refused hole and its placement (up to five, then a count) and the fix. An import commit fails that row and a bulk update fails that record. No new error code.

The plugin logs a warning when the engine it is given has no hook registry, so an embedder without one is told the check is not running.

Tests

• src/template-hole-placement.test.ts (74): both supported placements; every refused class; the label table's completeness; elements closing and judging afresh; the script comment escape; abrupt comments, declarations and reconsumed characters; the readings (foreign content never left, a self-closed root opening none, the noscript straddle, the select / frameset fork, a plain style element not forked); the renderer's grammar and spans; parity with renderNotification's substitution; isHtmlFormat matching the html face.
• src/objects/notification-template-placement.integration.test.ts (20), on a real ObjectQL over SqlDriver through ObjectStackProtocolImplementation, mapDataError and runImport: html and mjml creates refused at the REST data door with nothing stored; the message naming each hole and counting past five; the positive twins; text, markdown and an absent format not judged; a by-id move to html refused; an import commit's failed row; a stored violating row refused on an edit of another column, on a bulk update's row while the other row lands, and on a predicate update that then writes no row; an edit moving the hole or the format accepted; the row still read, deleted and rendered as before; and the plugin binding the hooks on a booted kernel and unbinding them on destroy().
• text-field-html-outlets.pin.test.ts: the two new files are classified as non-outlets (they render nothing).
• pnpm --filter @objectstack/service-messaging test: 58 files, 722 tests pass. typecheck passes. ESLint over the changed files is clean.

Acceptance notes

• The branch is the harness-pinned claude/project-thread-iydt23; it names no issue, so the Duplicate Fix Guard's branch-name hint will not match. The claim comment on mail templates: a hole an author places in a template body may not be encoded for the context it lands in (reach not measured; detail withheld under the disclosure ruling) #25082 is the identity record.
• No package export is added: the judge and hooks are module exports only, and index.ts is unchanged.
• The changeset is patch (Metadata-protocol none) with the BREAKING banner and an ADR-0087 not-required (no-migration-prescription) disposition; check:adr-0087-registration reads it.
• plugin-email, service-messaging: retire the render exports that take a template body with no save moment (renderTemplate, renderNotification) — #25082 ruling F2 B3 #25190 (retiring the renderTemplate / renderNotification exports) follows this card and is not addressed here.
• Per the disclosure ruling on skills: five principle gaps the #9296 wave exposed in checklist-test / checklist-author / dogfood-verification #9387, nothing in this PR or its comments carries a probe or a sample value. The test bodies carry holes and markup only.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/service-messaging, touching 55 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/services/service-messaging/src/objects/notification-template.object.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

28 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 0b8bce40e081477132d81b1e11a19cd3cdb331c0.

⛔ 7 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/services/service-messaging/src/objects/notification-template.object.ts) — pages documenting those are invisible to this run
• 16 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 5 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 0b8bce40e081477132d81b1e11a19cd3cdb331c0 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 686fc3443036576632edaea66c5208655f5f2eec — the merge of head 4ca18be6c30c39bf186d02c68236d79b3af1af4a into base 0b8bce40e081477132d81b1e11a19cd3cdb331c0, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 686fc3443036576632edaea66c5208655f5f2eec && git checkout 686fc3443036576632edaea66c5208655f5f2eec
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 0b8bce40e081477132d81b1e11a19cd3cdb331c0 4ca18be6c30c39bf186d02c68236d79b3af1af4a && git checkout -B drift-repro 0b8bce40e081477132d81b1e11a19cd3cdb331c0 && git merge --no-ff 4ca18be6c30c39bf186d02c68236d79b3af1af4a

node scripts/docs-audit/affected-docs.mjs --json 0b8bce40e081477132d81b1e11a19cd3cdb331c0

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 0b8bce40e081477132d81b1e11a19cd3cdb331c0 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 4ca18be6c30c39bf186d02c68236d79b3af1af4a
Local-runs: none
Scope: .changeset/25082-notification-template-hole-placement.md, packages/services/service-messaging/src/template-hole-placement.ts, packages/services/service-messaging/src/notification-template-placement.ts, packages/services/service-messaging/src/template-renderer.ts, packages/services/service-messaging/src/messaging-service-plugin.ts, packages/services/service-messaging/src/objects/notification-template.object.ts, packages/services/service-messaging/src/template-hole-placement.test.ts, packages/services/service-messaging/src/objects/notification-template-placement.integration.test.ts, packages/services/service-messaging/src/text-field-html-outlets.pin.test.ts + packages/services/service-messaging/src/index.ts, packages/objectql/src/engine.ts (registerHook / unregisterHooksByPackage, the by-id and per-row beforeUpdate dispatch, insertMany), packages/objectql/src/plugin.ts, packages/core/src/kernel.ts, packages/types/src/validation-failure.ts, packages/types/src/data-error-classification.ts, packages/core/src/utils/import-runner.ts, packages/metadata-protocol/src/protocol.ts (updateManyData), packages/plugins/plugin-security/src/grant-permission-set-name.ts, scripts/check-adr-0087-registration.mjs, scripts/check-changeset-no-major.mjs, docs/adr/0087-metadata-protocol-upgrade-contract.md, .github/workflows/pr-automation.yml (Check Changeset), AGENTS.md (Post-Task Checklist 3), .changeset/24983-template-channel-refusal.md, .changeset/25061-notification-template-html-escape.md

Face: narrowing, declared Clause-②: no (narrowing) on the PR body and the changeset. Inputs: card #25082 (body, every comment; ruling 6335348115 items 2 to 4 govern), PR #25258 (body, file list, net diff against main at the base 6bc8cc6a), the 41 check-runs on this head (every one success or skipped; nothing failed or is pending). Read-only: nothing built, run or re-run. Abstract under the disclosure ruling on #9387 (5323310017): placements are named by class only.

① Derived judgments

A. The accept set of sys_notification_template writes narrows — right, and exactly as ruled. A write that leaves a row whose format is html or mjml with a hole outside element text or a quoted plain-text attribute value is refused. The judge is derived from the renderer's one encoder (escapeHtml in template-renderer.ts: the five markup characters become references, nothing else changes), and that encoding is correct in exactly the two admitted placements. Verified against the renderer at the head: isHtmlFormat is the renderer's own test (strict equality on the two spellings, no case folding, so the rows judged are exactly the rows encoded), and templateHoles reads the renderer's own TOKEN, so the spans judged are the spans substituted (the parity test replays renderNotification byte for byte over a corpus that includes non-hole brace pairs).

B. Fail-closed under every parser reading the judge claims to fork — right. I walked the scan against the HTML tokenizer and tree-builder rules rather than taking the module note on trust:

• Tokenizer states (data, tag open, end-tag open, tag name, the attribute-name and attribute-value states, self-closing, markup declaration, comment with its abrupt and bang closers, bogus comment, raw / escapable text and their end-tag recognition, plaintext) match the specification's transitions on every character that can move a hole. Every state other than data, escapable text, and a double- or single-quoted value on a non-end tag yields a refused class. A hole that lands where it could complete a closing tag or sits in a tag outside any value is refused as tag.
• The raw / escapable element set is the specification's (script, style, xmp, iframe, noembed, noframes, noscript; title, textarea; plaintext never left). The fork at a noscript start tag (scripting off in a mail client reads it as markup) and at every raw / escapable start tag once a select or frameset has opened (the tree builder may ignore the start tag, or — for textarea in select — close the select and honour it) refuses under the conjunction of both readings; a text reading rejoins the markup reading at the end tag, and the select / frameset flag is never cleared, which only refuses more. The script comment-escape handling refuses until the closer and does not model the double-escaped sub-states, which again only refuses more.
• Foreign content: from an svg or math start tag that is not self-closed, every later hole is refused; a self-closed root opens none, which is what the tree builder does. Integration points and breakout tags are not modelled, so a hole a parser would place back in HTML text is still refused — over-refusal, never admission.
• Readings above the cap mark every later hole refused. No path through the scan admits a hole a parser could place outside the two encoded contexts.

C. Is anything the judge ADMITS unsafe? No, under the ruling's criterion (encoding by context). The admitted set is element text (including the two escapable-text elements, where the encoder's reference-encoding is the right encoding) and a quoted value on an attribute that is not read as a URL, a URL list, a handler, a style sheet, markup, or a meta element setting. I checked the URL table against the current and legacy URL-bearing attributes a mail client acts on (href, src, srcset, imagesrcset, action, formaction, cite, data, poster, background, longdesc, usemap, codebase, classid, archive, code, profile, manifest, icon, ping, lowsrc, dynsrc, datasrc, itemtype, itemid, xmlns, every namespaced attribute, and the plugin parameter value); the event-handler prefix and the style attribute are matched after lower-casing; every attribute of a meta element is refused as a class of its own. What remains admitted (class, id, title, alt, width, data-*, target, rel, type, and the like) is text the encoder makes inert in a quoted value. One class the ruling's words do not reach is left admitted: a quoted attribute whose value selects a document setting on a non-meta element (an iframe's sandbox or allow list, a base target). The encoder is correct for it — a value cannot leave the quotes — and a value there changes a setting rather than becoming markup, so it is a semantic choice of the author, not an encoding gap; mail clients do not honour those elements. Named here so it is not read as missed.

D. Judged over the merged record on every engine write path — right, verified in the engine. beforeInsert dispatches once per row with input.data (the array form and insertMany route through the same insert); a row naming no format is judged with the object's declared default (markdown, so not judged — right). beforeUpdate carries previous on the by-id path (the prior read the engine already does) and on the per-row dispatch of a predicate update (ADR-0058 Addendum II; hasHooksFor is per object, so this registration triggers it), the unscoped multi: true form included. The hook overlays only defined keys, so a key carried as undefined leaves the stored value standing and body: null clears the holes (right). The engine has no hook-skipping switch, so system-context writes are judged too, as the PR states; the object's channel_renders_template rule is the precedent for that stance. A stored violating row is refused on any edit that leaves it violating, and is still read, listed, deleted, loaded by NotificationTemplateStore and rendered unchanged (pinned on a real ObjectQL / SqlDriver; nothing runs at send; no row rewritten). Frozen, not bricked — ruling item 4.

E. The envelope — right, no new error code. validationFailure (the @objectstack/types constructor both HTTP doors map) with one finding at body, code: 'invalid_value', label from the field declaration; mapDataError answers 400 VALIDATION_FAILED (pinned); the import runner builds the row report from fields[0] (field: 'body', code: 'invalid_value', message head within the 300-character cut, with the refused hole and the way out placed first — right); updateManyData carries VALIDATION_FAILED / httpStatus: 400 on the failed record while the other record lands (pinned); a predicate update over a set holding such a row writes no row (pinned). The message names up to five holes with their placement class then counts the rest, names the two supported placements, and sends a link-from-value to email_template — ruling item 2's "naming the placement and the supported ones".

F. Hooks bind and unbind — right. bindTemplateHolePlacement refuses a double (returns false) when no registerHook exists, unbinds first so a re-bind replaces rather than stacks, and registers both events under one packageId scoped to the object at priority 30 (the plugin-security grant-name precedent's shape). unregisterHooksByPackage in the engine filters that packageId out of every event. The plugin binds in init after ctx.getService('objectql') — the objectql plugin is a declared dependency and registers that service in its own init, so the engine is present at that point; destroy() (which the kernel calls on shutdown, in reverse order) unbinds and clears the reference. Pinned on a booted kernel: refused after bootstrap, accepted after destroy(). When the service is absent or has no registry the plugin warns and runs without the check — a fail-open by design for an embedder without ObjectQL, stated in the PR body; flagged under ③.

G. Public surface — unchanged (right). index.ts is a named export list (no export *) and is not in the diff, so the new module exports (templateHoles, isHtmlFormat, TemplateHole, the judge, the hook binders) are package-internal. The outlet census pin lists the two new files as non-outlets with their reason — right, they render nothing. The object docblock gains the rule; no field, index, rule or default changes, so the object's declared shape is unchanged.

H. Tests — the claims are pinned, not asserted. 74 unit cases cover both supported placements, every refused class (and the label table's completeness against the closed type), element closing, the comment and declaration edge states, reconsumed characters, the foreign-content, noscript and select / frameset readings, the renderer's grammar and span parity; 20 integration cases cover both doors, import, bulk, predicate, stored-row freeze and repair, read / delete / render, and the plugin's bind / unbind. Test bodies carry holes and markup only, never a value.

② Semver level

@objectstack/service-messaging: patch, with the **BREAKING** banner, the ! summary and PR title, Clause-②: no (narrowing) and Metadata-protocol: none on both the PR body and the changeset, and one ADR-0087 marker: not-required (no-migration-prescription). This is exactly what the ruling orders ("patch with the BREAKING banner and ADR-0087 disposition (#25105 A); Metadata-protocol: none under A2") and what AGENTS.md's Post-Task Checklist 3 now states: a non-protocol narrowing ships patch and keeps its BREAKING carriers. The two sibling changesets on this object (24983, 25061) shipped minor under the earlier launch-window convention; patch is the current rule, so the difference is the rule moving, not this PR. Metadata-protocol: none is right: the rows are admin-authored data on a platform object, not metadata; no spec key, accepted value, metadata type or default moves. The disposition's category is right on the facts (no ADR-0087 conversion reaches a stored data row; the remedy is the author's edit of a row), and its body carries no arrowed FROM → TO mapping, so the gate's prescription detector is not contradicted; Check Changeset (which runs the ADR-0087 registration gate and the no-major guard) is success on this head. The Clause-②: line is right: nothing widens (no new export, no new accepted value, no new door), and the narrowing is the one the ruling ordered, nothing more.

③ Boundary flags

• Dev report 6347340972: open_questions: []. Nothing to escalate from the build. The measuring pass's F1 to F4 (6334219164) are answered by ruling 6335348115 and this PR follows items 2 to 4 (F2 / B3 is plugin-email, service-messaging: retire the render exports that take a template body with no save moment (renderTemplate, renderNotification) — #25082 ruling F2 B3 #25190, F1 / A2 is lint: an error-tier authoring rule refuses an email_template body hole the renderer cannot encode for its placement (#25082's email half, ruling F1 A2) #25189, both outside this PR by the ruling's own split).
• Deviation: harness-pinned branch claude/project-thread-iydt23, not claude/issue-25082-…. The claim comment 6345584878 is the identity record; the closing-target claim guard is success on this head. Answered.
• Deviation: a fourth relay write (pr_request_reviewers). Process, not code; noted.
• Ruling item 3's "five non-production bodies the build corrects". All in-tree bodies placing a hole in a URL attribute are email-template bodies (plugin-email's built-ins and the dogfood email-template fixture); there is no html or mjml sys_notification_template row anywhere in the tree, so none of the five belongs to this half — they are lint: an error-tier authoring rule refuses an email_template body hole the renderer cannot encode for its placement (#25082's email half, ruling F1 A2) #25189's. Answered; nothing owed here.
• Ruling item 3's raw-hole shape. This face has no raw hole form and no declared variable typing, so no URL hole can be admitted; the refusal routes link-from-value to email_template, which has both. Consistent with the ruling, not stricter in any way an author can meet differently.
• Vocabulary parity with the email half. The PR adds one class (meta-attribute) to the shared class names; the email half (fix(lint)!: refuse an email template HTML body hole the mail renderer cannot encode for its placement (#25189) #25212, draft) is not on main, so parity is owed by whichever lands second. The dev's out-of-scope note (the email half models fewer readings in two classes) is carried on lint: an error-tier authoring rule refuses an email_template body hole the renderer cannot encode for its placement (#25082's email half, ruling F1 A2) #25189. Not this PR's to fix.
• Fail-open without a hook registry. An embedder whose objectql service is absent or exposes no registerHook gets a warn and no judging. In-tree every kernel composition registers ObjectQL; the PR body states the behaviour. Accepted as declared; an embedder reading that log line is told the check is not running.
• Docs. Docs Drift Check lists 28 hand-written pages naming touched identifiers; none carries a notification-template html example with a hole in a refused placement (searched the docs tree). No page is falsified by this diff; the object's body description still says "Interpreted per format", which remains true.
• Disclosure. The PR body, the changeset and this record name placements by class only. The test files necessarily spell each class with an inert hole and no value, the same shape PR fix(service-messaging)!: an html or mjml notification template escapes every hole for markup, and each outlet package pins its outlet list (ruling 3C) #25076's tests took under the same ruling.

Implemented-by: claude/project-thread-iydt23
Reviewed-by: session_016g7nYP9wdNx1GDa5XDr7Uy

VERDICT: PASS

[objectstack-fleet]

席位核对 · ACCEPT · 2026-10-22T17:58Z

domain:services seat 1 (seat post #6021) · os-sales · session_016g7nYP9wdNx1GDa5XDr7Uy · card #25082 (ruling 6335348115, items 2–4; card session branch claude/project-thread-iydt23) · reviewed head 4ca18be6c30c39bf186d02c68236d79b3af1af4a

⛔ Disclosure (#9387): abstract. The PR body, the report 6347340972 and the contract review were read for reproductions first; none carries one.

• Shape: service-messaging's own hole-placement judge (placement table re-derived from the renderer's encoder, reading the renderer's own hole token) plus beforeInsert / beforeUpdate hooks on sys_notification_template, bound in init, unbound in destroy(). 9 files, +1423 / −2; no package export moves.
• Ruling conformance: merged-record judging (by-id and per-row predicate updates); stored violating rows frozen, not bricked (read, delete, render, deliver unchanged); the existing 400 VALIDATION_FAILED at body / invalid_value; no new error code; no migration.
• Contract review: CONTRACT_REVIEW_TIER, isolated, record 6347584087 on this head — PASS, Local-runs: none, scope all 9 paths plus 16 cited files.
• Declarations: fix(service-messaging)!, Clause-②: no (narrowing), Metadata-protocol: none, patch with the BREAKING banner, ADR-0087 not-required (no-migration-prescription); Check Changeset green.
• Dogfood battery: full, on this head under the verify lock (288 files pass / 3 skipped; 2411 tests pass / 18 skipped; 0 failures).
• Gates: dispatch-gates --ran 70 / 70; service-messaging 722 / 722; every check-run on this head success or an expected skip.
• Accepted deviations: the harness-pinned branch (claimed); one pr_request_reviewers relay write beyond the three-write budget (the project requires the reviewer).
• Not blocking, noted: the plugin logs a warn and does not judge when the engine has no hook registry (declared in the PR body); quoted setting-type attributes on non-meta elements stay admitted — the encoder is correct there. The meta-attribute class has no twin in the draft email half (fix(lint)!: refuse an email template HTML body hole the mail renderer cannot encode for its placement (#25189) #25212); parity is owed by whichever half lands second — the spec lane is told on lint: an error-tier authoring rule refuses an email_template body hole the renderer cannot encode for its placement (#25082's email half, ruling F1 A2) #25189.
• Landing: not governed (check-governed-merges --pr 25258: 0 of 9 paths, 1425 lines). Ready + auto-merge through the relay.

---

Generated by Claude Code